Overview
The Share Protocol (SP/1) specifies how a person grants, monitors, and revokes access to their own contact details — and how every step of that exchange is made cryptographically verifiable by third parties.
It was designed for the hardest version of the problem: regulated lead flows (for example, CMS one-to-one consent rules for Medicare marketing), where the question “did this person really agree to this disclosure, naming these companies, on this page, under these terms?” gets asked years later, under audit, by someone with no reason to trust anyone in the transaction.
The trust inversion
Section titled “The trust inversion”Existing consent-certification products answer that question with custody: “we recorded it, trust us.” The Share Protocol answers it with construction:
- Every fact a verifier cares about is serialized with a deterministic canonical JSON algorithm and committed to a SHA-256 fingerprint.
- Every protocol event is appended to a hash chain where rewriting any historical row breaks every subsequent hash.
- The chain head and every material event are anchored externally into an independent append-only ledger with Ed25519-signed tree heads and client-verifiable Merkle proofs.
An auditor holding a certificate, this specification, and ~50 lines of code can verify a record with zero trust in the operator. That property — not any single feature — is the protocol.
Actors
Section titled “Actors”| Actor | Role |
|---|---|
| Subject | The person whose data is exchanged. Holds the canonical copy; grants and revokes. |
| Recipient | The business receiving fields under an explicit grant (scope, purpose, expiry). |
| Hub | The operator implementing this protocol (reference: PRYVC). Custodian, never owner. |
| Verifier | Anyone — carrier, auditor, regulator, the subject — checking evidence. Needs no account and no trust in the hub. |
Design principles
Section titled “Design principles”- Consent is scoped, purposed, and finite. A grant names exact fields, a stated purpose, and an expiry. Nothing is implied, nothing is forever.
- Revocation is a first-class verb. Revokes trigger an obligation clock with acknowledgement semantics; silence is recorded as evidence too.
- Verifiable without trust. All evidence formats are deterministic, published, and reproducible from this spec. Test vectors are normative.
- Fail-open capture. Evidence capture must never break the host page’s primary flow. A lost anchor degrades evidence, never commerce.
- Data minimization. Wire formats carry the minimum; evidence formats carry hashes, not values. Nothing in the public verification surface exposes PII.
- The subject’s copy is canonical. Updates propagate from subject to recipients within scope (“change once, update everywhere”) — never sideways.
What this site contains
Section titled “What this site contains”The specification (normative, RFC-2119 language, with test vectors generated from the reference implementation), the conformance checklist for implementers, and the versioning & governance policy. The reference implementation’s product documentation lives at developers.pryvc.com.